Secret Sharing Data Storage Across Trusted Nodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data storage methods in multi-cloud architectures face challenges in ensuring confidentiality, integrity, and availability of sensitive data, particularly in zero trust network environments, where local storage failures and key management issues are prevalent, and existing secret sharing techniques struggle with reconstructing secrets from shared portions stored remotely.
Innovation Solution
The implementation of a secret sharing scheme using trusted nodes, where input data is divided into shared portion sets and stored across multiple trusted nodes, allowing reconstruction of the original data from a sufficient number of shares without exposing all shares at once, leveraging a trusted execution environment (TEE) for secure data processing and storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored in a single location (local storage or single cloud), then storage simplicity is maintained, but reliability and availability deteriorate due to single-point failures
Solution Approach 1:
The patent divides the original data into multiple shared portions using secret sharing schemes and distributes them across multiple trusted nodes. This segmentation eliminates single-point failures while maintaining storage simplicity from the user perspective, as the system automatically manages the distributed architecture.
2Reliability
If conventional secret sharing is used to distribute data across multiple clouds, then confidentiality is improved, but availability deteriorates because secrets cannot be reconstructed from remotely stored shared portions
Solution Approach 1:
The patent introduces trusted nodes as intermediaries between the user and remote cloud storage. These trusted nodes hold the shared portions locally and enable secure reconstruction of secrets through coordinated computation, bridging the gap between confidentiality requirements and reconstruction availability.
3Reliability
If encrypted storage is implemented to protect data confidentiality, then security is improved, but operational complexity worsens due to key management and re-keying requirements
Solution Approach 1:
The patent extracts the key management complexity from the user's responsibility by using secret sharing schemes where the secret is divided into shared portions distributed across trusted nodes. No central encryption key needs to be managed or re-keyed, as the secret reconstruction naturally occurs through the trusted execution environment when needed.
4Reliability
If multiple copies of data are stored in multi-cloud architecture, then availability is improved, but security deteriorates by introducing single-point problems in zero trust network environments
Solution Approach 1:
The patent applies local quality by ensuring that each trusted node holds only a specific shared portion that is useless alone, while the combination of sufficient portions at trusted locations enables reconstruction. This creates different security properties at different locations, preventing any single point from compromising the entire system.
Data Source
AI summary
Embodiments of the present disclosure relate to a data storage method, a data read method, an electronic device, and a computer program product. The data storage method includes: acquiring identifiers of a predetermined number of trusted nodes, the predetermined number being associated with a secret sharing scheme to be used; generating a predetermined number of shared portion sets from input data by using the identifiers respectively as parameters of the secret sharing scheme; and respectively storing the predetermined number of shared portion sets in the predetermined number of trusted nodes according to a correspondence relationship between the predetermined number of shared portion sets and the predetermined number of trusted nodes. With the technical solution of the present disclosure, input data can be efficiently protected with trusted nodes by using a secret sharing scheme, and the confidentiality and integrity of the input data can be guaranteed.